Sophos Network Detection and Response

Sophos Network Detection and Response

Reveal network activity that may go unnoticed at the endpoint

Sophos Network Detection and Response (NDR) analyses network traffic for signs of attacks. It adds another perspective to endpoint protection: unmanaged devices, connections between systems and unusual communications can also become visible in the monitored network segment.

Key benefits of Sophos NDR

• Additional network visibility: Network flow data help identify unknown devices and suspicious connections.
• Signs of attacker communications: Multiple detection methods examine potential command-and-control connections, among other indicators.
• Analysis of encrypted connections: Traffic characteristics and TLS metadata can reveal anomalies without decrypting all content.
• Less scattered evidence: Scoring and grouping help prioritise relevant detections.
• Investigation context: Results can enrich analysis by your XDR team or the Sophos MDR service.

Key Sophos NDR features and capabilities

• Passive sensor: NDR receives a traffic copy through a SPAN/mirror port or a suitable TAP connection. It is outside the direct transmission path and does not block connections as a sensor.
• Flexible deployment: Supported virtual environments, AWS and certified hardware enable deployment at relevant network locations. Sizing and sensor count depend on the monitored traffic.
• Working with XDR and MDR: Network findings can be investigated alongside other security data. Responses use the relevant tools, integrations and permissions; an NDR sensor alone is not a managed security operations centre.

Sophos NDR is licensed by users and servers. The virtual appliance is included in the subscription; required infrastructure and additional hardware are separate. Before deployment, establish which segments the sensor can actually observe.

Conceptual NDR sensor architecture

The sensor derives network flow information from the traffic copy and evaluates it using multiple detection methods. Relevant results are made available for central investigation. This adds visibility without introducing an inline point of failure into the data path. However, its passive position does not remove the need to secure and maintain the sensor itself.